Advice considering a workstation laptop as daily driver

[ftpsuper]

Dear community,

I’ve been running Qubes on my desktop as my daily driver for about 6 months now and am feeling comfortable. I intend to switch to a laptop in the following months. In general my usage of Qubes is below, % referring to the time spent:

i) General browsing (news, forums, email, etc) - 50%
ii) Youtube - 30%
iii) Zoom - 10%
iii) Win10 HVM - 10%

My desktop runs i5-8400 (6C6T), 8+16GB RAM. I watch Youtube a lot and usually have them up almost full screen. I have 3-4 VMs concurrently most of the time. So far system is very stable with no loud fan noise.

Now I plan to invest in a reliable laptop for the long term. I’ve been thinking about the Thinkpad P-series due to it being Workstations. Budget is generally no issue. I have outlined 3 possible options: 1) P15v, 2) P15, 3) 2nd hand. But I have some doubts and I wish to ask some advice from the community about selecting a workstation laptop as my daily driver :),

1. P15v. Does anyone have experience with i7-10750H whether it runs Youtube/Zoom smoothly without high CPU load/loud fan? Comparing to my i5-8400, the highest temperature I’ve seen was barely over 50C. Fan speed ~1005rpm. I come from a desktop processor environment so I wonder how does laptop processor nowadays fare due to thermal throttles. I especially like the Intel H-series due to its 45W TDP (also open to suggestions!). I’ve noted that HCL listed a P15v with Intel UHD that works fine out of the box, thus making this my 1st choice. But I wonder how it holds up for graphical intensive like Youtube/Zoom?

2. P15. This leads me to a compromise I am willing to make in hopes of better thermals. P15 is a thick and heavy beast I know. Thus I’m considering also other slimmer P-series models but I’m not sure whether they might last due to thinner chassis. Does anyone have experience with ~<20mm chassis thickness? My unverified opinion is that thin laptop designs is not ideal due to poorer heat dissipation since Qubes is CPU-intensive. However if thermal tech has advanced such that its a non-issue then I’m most happy to settle with a thinner laptop. Mostly my concern is when I run almost stuff like Youtube/Zoom, do modern laptops hold up well? I’m interested in P15 purely because of its thicker chassis. However I’ve noted that prior models (P5X) seem to have issues here and there according to HCL, and I’m not technical enough.

3. 2nd hand Thinkpads. What is your view regarding security risks of buying a 2nd hand device? e.g. possibility of a compromised BIOS/HDD/spyware. Of course the first thing I’d do would be to reformat it and replace with a new SSD. However what’s the risk of a malware “hiding” inside the BIOS/Mobo infecting my clean SSD? Is this threat non-existent or extremely remote? What could be done to protect oneself against this, as this option to me is clearly the most convenient due to more options (eg. Ebay) and cheaper.

Finally I start to see Ryzen 7 pro 5000-series and Intel 11th gen on the market. What’s the view regarding Qubes support for such processors? Are they too new at this moment, what’s the rule of thumb timeline for a next-gen processor to achieve reasonable support?

Thank you everyone in advance!

[fsflover]

Purchasing a new (or second hand) laptop

Hi, I would like to ask for your help with purchasing a new (or second hand) laptop. My ideal choice is a 14’’ business laptop which is strong enough to constantly and smoothly run a windows VM with high load and several other VMs (usually two Whonix VMs, sys-net, sys-firewall, and some other). It has to be durable and portable. It would be nice to have coreboot or open-source firmware and IME disabled. I am currently using a Lenovo X230 which is a very good laptop, but it has two serious lim…

Different Laptops

What laptops have or do people use to run Qubes on?

[Quser59]

@ftpsuper

I’ve been thinking about the Thinkpad P-series due to it being Workstations

Thinkpads/lenovo are better supported than other brands. Qubes devs use X1 Carbon (gen5) so that series is a good bet, see mailing lists for support.
Only thing regarding P series is it is quite hard to get one without a dGPU. This is why I prefer dell, (or look at x1 carbon). I would buy brand new from a company who resells corporate returns - you will pay far far less and still get warranty.

@ftpsuper

P15v. Does anyone have experience with i7-10750H whether it runs Youtube/Zoom smoothly without high CPU load/loud fan?

I have experience with an older generation of that CPU series and it’s absolutely fine. Got to note that Qubes 4.1 has much better performance IMO (and given the issues I had with 4.0.x, I don’t consider it ‘unstable’).

@ftpsuper

P15.

If don’t know so much about the Thinkpads, but I know with workstations a couple generations old they can thermal throttle on the slim models - though bare in mind without a dGPU you should be fine. I personally love the thicker workstations because they are far, far more rugged. If I had a thin workstation it would be severely crippled by now, (and what I would consider only ‘gentle’ treatment).
If you want ultra portable, go thin, if you want durable, go thick.

@ftpsuper

What is your view regarding security risks of buying a 2nd hand device? e.g. possibility of a compromised BIOS/HDD/spyware.

You can reduce this by buying from a reputable company. I’m not going to name companies (because I want to continue to buy cheap laptops), but if you find a company that gets its laptops from companies who bulk order and then send them back for whatever reason - they may be listed as ‘refurbished’ but they will be brand new and on the enterprise workstations you get a significant discount and with full warranty.
Always replace the hard drive is my advice (they normally come with a crappy ssd anyway). IMO nearly all new laptops will have some sort of spyware on them from the manufacturer, or Intel, so the relatively minimal risk that some advanced firmware hackers are running a 2nd hand laptop shop is one I’m willing to take.
Using Qubes your exposure is pretty minimal to such things anyway, due to the nature of Xen & multiple VMs - it won’t be as simple as firmware designed to re-install on windows. Plus I assume there’s lots of advanced firmware stuff out there most of us don’t know about, so I wouldn’t worry about this (there’s not much you can do other than buy a really old thinkpad, but then that has it’s own downsides).

@ftpsuper

Finally I start to see Ryzen 7 pro 5000-series and Intel 11th gen on the market. What’s the view regarding Qubes support for such processors?

Check the mailing list, there is some support for AMD. Note new(est) generation hardware is typically less supported than hardware one/two generations old. IMO best to get something new that is one/two generations old and save money in the process.
Intel is still your best bet, read the docs for more info.

[ftpsuper]

Nice thoughts there! Thank you for sharing, really appreciate it

[ftpsuper]

Thank you for the links. Yes some of them I have gone through previously but didn’t really answer my doubts (I am perhaps overly specific on certain models).

[kylebrookes]

Great solutions and useful information. Thanks for this discussion.